ClawHub
Back to skill

Security audit

monitoring-twitter-for-competitor-job-posts

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Twitter/X monitoring workflow that uses Apify, with a credential-handling caution but no evidence of hidden or malicious behavior.

Install only if you are comfortable using Apify to query Twitter/X data for competitive intelligence. Treat APIFY_TOKEN as a secret, prefer the MCP or a safer client/helper over raw curl URLs with token parameters, set a maxItems limit for predictable usage, and avoid saving sensitive results somewhere unintended.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~tweet-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"searchTerms": ["[COMPETITOR] hiring", "[COMPETITOR] join our team", "[COMPETITOR] job opening"], "maxItems": 100}'
Confidence
95% confidence
Finding
The REST example embeds APIFY_TOKEN directly in the request URL query string. Query-string secrets are commonly captured in shell history, process listings, proxy logs, server logs, and monitoring tools, which can leak the credential beyond its intended scope.

External Transmission

Medium
Category
Data Exfiltration
Content
Wait for `SUCCEEDED`. Fetch dataset:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"
```

### Step 3: Classify Results
Confidence
95% confidence
Finding
The dataset retrieval example again appends APIFY_TOKEN to the URL, creating the same exposure path through logs, browser history, terminal history, and intermediary systems. Repeated examples normalize insecure secret handling and increase the chance of credential leakage during routine use.

External Transmission

Medium
Category
Data Exfiltration
Content
Wait for `SUCCEEDED`. Fetch dataset:
```bash
curl "https://api.apify.com/v2/actor-runs/$RUN_ID/dataset/items?token=$APIFY_TOKEN"
```

### Step 3: Classify Results
Confidence
95% confidence
Finding
The dataset retrieval example again appends APIFY_TOKEN to the URL, creating the same exposure path through logs, browser history, terminal history, and intermediary systems. Repeated examples normalize insecure secret handling and increase the chance of credential leakage during routine use.

Missing User Warnings

Low
Confidence
84% confidence
Finding
This markdown file exposes a prerequisite to set `APIFY_TOKEN`, and later uses it in example commands, but it does not include any user-facing warning about protecting the token or avoiding accidental exposure in shells, logs, or shared environments. Because the skill depends on a credential and makes external API calls, a brief warning would improve safe use.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.